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DETAILED ACTION 

1; Claims 1-50 have been examined. 

Response to Amendment 

2. The objections to claims 36 and 39 are withdrawn as the amendments to the 
claims overcome the objections. 

Response to Arguments 

3. Applicant's arguments with respect to amended claims 1-50 have been 
considered but are moot in view of the new ground(s) of rejection. 



Drawings 

4. As specified in the previous office action, the drawings are objected to as being 
informal. The original drawings are acceptable for examination purposes but applicant 
will be required to submit formal drawings when a Notice of Allowance is submitted. 

Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, rf the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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6. Claims 1-16, 18-42, and 44-50 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Wells U.S. Patent No. 6,338,141 (hereinafter Wells) in view of Frisch 
Essential System Administration (hereinafter Frisch) and Kim "The Design and 
Implementation of Tripwire: A File System Integrity Checker" (hereinafter Kim). 

7. As per claim 1 , Wells discloses a method of detecting computer viruses on a 
single, stand-alone computer system or on a networked machine using an antivirus unit 
(see Wells, abstract). Wells does not expressly disclose providing a disk space having 
at least a portion that is partitioned into separate segments, each segment being 
accessed by at least one of a plurality of hosts, wherein a first one of the segments is 
accessed using a different file system than a second one of the segments. However, 
this configuration is found in several operating systems. For example, Frisch teaches a 
UNIX operating system that enables a flexible partitioning capability wherein each 
partitioned segment is accessed using a different file system. See Frisch, pages 409- 
414 *From Disks to Filesystems', especially page 409, first paragraph in the section. It 
would be obvious to one of ordinary skill in the art at the time the invention was made 
for the method of detecting a virus to be actuated on a disk space having at least a 
portion that is partitioned into separate segments, each segment being accessed by at 
least one of a plurality of hosts, wherein a first one of the segments is accessed using a 
different file system than a second one of the segments. Motivation to combine enables 
an administrator broader control to allow or restrict access to information on a disk by 
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segmenting the disk on a partition level as taught by Frisch. See Frisch, page 394, 2""^ 
and 3^^ paragraphs. 

8. Further, Wells does not expressly disclose scanning for a virus on a portion of 
the disk that includes a part of the first and second segments. However, means of 
selectively checking the integrity of separate filesystems on a disk is a feature of the 
UNIX tool Tripwire. Kim teaches how different filesystems on a disk can be checked by 
entering the paths of relevant filesystems as well as corresponding selection-masks, 
which classifies how to observe changes in the filesystem, in the Tripwire configuration 
file (see Kim, page 1 1 , Figure 2 and related text). Furthermore, Kim teaches Tripwire as 
a function operating in a larger security methodology: the results of a Tripwire check can 
be used by a filter program (see Kim, page 12, 2"^ paragraph, 'quiet option'). It would 
be obvious to one of ordinary skill in the art at the time the invention was made to 
selectively scan separate filesystems on a disk space for viruses. Motivation to 
combine enables the method to secure any suspicious subset of data on a disk, even 
across partitioned boundaries. 

9. Finally, the invention of Wells scans all types of files and does not limit scanning 
to only non-native files. Further, file sharing between different operation systems is a 
common feature among networked systems. As taught by Frisch in a different chapter, 
non-native files are transferred between a UNIX system and any reachable system 
(non-local and/or non-UNIX) using commands "ftp" and "telnet". See Frisch, page 587, 
4^ and 5^ bullets. Non-native files downloaded from non-local and/or non-UNIX 
platforms are incorporated into the local filesystem and likewise are a portion of the disk 
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space to be scanned. It would be obvious to one of ordinary skill in the art at the tinne 
the invention was made for the antivirus unit, using a particular operating system, to 
access non-native files created using operating systems different from the particular 
operating system that is used by the antivirus unit in connection with scanning at least 
parts of the disk space for viruses since file sharing is a common technique between 
different operating systems as known to one of ordinary skill in the art and as taught by 
Frisch. Ibid. The aforementioned cover the limitations of claim 1 . 

10. As per claim 2, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, the first and second segments correspond to 
different physical portions of the disk space. See Frisch, page 410, Figure 9-3. The 
aforementioned cover the limitations of claim 2. 

11. As per claim 3, Wells covers a method as outlined above in the claim 2 rejection 
under 35 U.S.C. 1 03(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments overlap. See Frisch, pages 39-41, "Links". It 
would be obvious to one of ordinary skill in the art at the time the invention was made 
for the first and second segments to overlap to enable information pertinent to multiple 
segments to be shared between the segments as taught by Frisch. Ibid. The 
aforementioned cover the limitations of claim 3. 
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12. As per claim 4, Wells covers a method as outlined above in the claim 2 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments do not overlap. See Frisch, page 395, Figure 9- 
1 , disk 1 . It would be obvious to one of ordinary skill in the art at the time the invention 
was made for the first and second segments to not overlap to organize segments into 
distinct logical partitions as taught by Frisch. Ibid. The aforementioned cover the 
limitations of claim 4. 

13. As per claim 5, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments correspond to logical entities. See Frisch, page 
395, Figure 9-1 , disk 1 . It would be obvious to one of ordinary skill in the art at the time 
the invention was made for the first and second segment to correspond to logical 
entities since it enables a direct correlation between a physical partition and a logical 
partition as taught by Frisch. Ibid. The aforementioned cover the limitations of claim 5. 

14. As per claim 6, Wells covers a method as outlined above in the claim 5 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments overlap. See Frisch, pages 39-41 , "Links". It 
would be obvious to one of ordinary skill in the art at the time the invention was made 
for the first and second segments to overlap to enable information pertinent to multiple 
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segments to be shared between the segments as taught by Frisch. Ibid. The 
aforementioned cover the limitations of claim 6. 

15. As per claim 7, Wells covers a method as outlined above in the claim 5 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments do not overlap. See Frisch, page 395, Figure 9- 
1 , disk 1 . It would be obvious to one of ordinary skill in the art at the time the invention 
was made for the first and second segments to not overlap to organize segments into 
distinct logical partitions as taught by Frisch. Ibid. The aforementioned cover the 
limitations of claim 7. 

16. As per claim 8, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, the part of the disk space that is scanned by the 
antivirus unit corresponds to particular types of files stored in the disk space. See 
Wells, col. 9, lines 1-4. The aforementioned cover the limitations of claim 8. 

17. As per claim 9, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Kim teaches identifying files that have been 
modified since a previous scan and using a filter program to generate an automated 
action in response to the identified files, and Wells teaches scanning selected files by 
an antivirus unit as an independent function within a larger collective antivirus 
methodology. See Kim, page 1 1 , section 4,2, tw.config selection-mask combination: 
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+m; page 12, 2""* paragraph; see Wells, col. 1 , lines 54-60. It would be obvious to one 
of ordinary skill in the art at the time the invention was made to apply the teaching of 
Kim to the method covered by Wells to ensure the integrity of a file has not been 
breached since a previous scan. See Kim, page 1, last line-page 2, first line; page 10, 
section 4.1 .3. The aforementioned cover the limitations of claim 9. 

18. As per claim 10, Wells covers a method as outlined above in the claim 9 rejection 
under 35 U.S.C. 103(a). In addition, Kim teaches examining a date of last modification 
for each of the files; and determining which files have been modified since a previous 
scan using the date of last modification for each of the files. See Kim, page 1 1 , section 
4.2, tw.config selection-mask combination: +m. It would be obvious to one of ordinary 
skill in the art at the time the invention was made to apply the teaching of Kim to the 
method covered by Wells to ensure the integrity of a file has not been breached since a 
previous scan. See Kim, page 1, last line-page 2, first line; page 10, section 4.1.3. The 
aforementioned cover the limitations of claim 10. 

1 9. As per claim 1 1 , Wells covers a method as outlined above in the claim 1 0 
rejection under 35 U.S.C. 1 03(a). In addition, Wells and Kim teach scanning the file for 
viruses in response to a date of last modification indicating a file has been modified 
since a previous virus scan. See Wells, col. 1, lines 54-60; see Kim, page 12, 2""^ 
paragraph. It would be obvious to one of ordinary skill in the art at the time the 
invention was made to apply the teaching of Kim to the method covered by Wells to 
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ensure the integrity of a file has not been breached since a previous scan. See Kim, 
page 1 , last line-page 2, first line; page 10, section 4.1 .3. The aforementioned cover the 
limitations of claim 11. 

20. As per claim 12, Wells covers a method as outlined above in the claim 1 1 
rejection under 35 U.S.C. 103(a). In addition, Wells and Kim teach comparing a current 
size of the file with a previous size of the file determined during the previous virus scan 
in response to date information indicating that a file has not been modified since a 
previous virus scan; and in response to the current size being different from the 
previous size, rescanning the file. See Kim, page 1 1 , section 4.2, tw.config selection- 
mask combination: +ms; page 12, 2""^ paragraph; see Wells, col. 1, lines 54-60. It would 
be obvious to one of ordinary skill in the art at the time the invention was made to apply 
the teaching of Kim to the method covered by Wells to ensure the integrity of a file has 
not been breached since a previous scan. See Kim, page 1 , last line-page 2, first line; 
page 10, section 4.1 .3. The aforementioned cover the limitations of claim 12. 

21 . As per claim 13, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Kim teaches implementing at least part of Tripwire 
using stand-alone hardware. See Kim, page 12, section 4.3.1 . It would be obvious to 
one of ordinary skill in the art at the time the invention was made to implement at least 
part of the antivirus unit using stand-alone hardware to ensure the inviolability of the 
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integrity database used by Tripwire. See Kim, page 12, section 4.3.1 , first paragraph in 
the section, 2"*^ sentence. The aforennentioned cover the linnitations of clainn 13. 

22. As per claim 14, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch and Kim teach implementing at least part of 
the antivirus unit as a process running on at least one of the hosts. See Frisch, page 
43, 'Processes'; see Kim, page 10, section 4.1.2, 'Scalability' and section 4.1.3, 
'Configurability and flexibility'; see Wells, col. 3, lines 10-11. It would be obvious to one 
of ordinary skill in the art at the time the invention was made for a part of the antivirus 
unit be a process running on at least one of the hosts since any application run on a 
machine comprises at least one process on the machine: as defined by Frisch, a 
process is a single program running in its own virtual address space. See Frisch, page 
43, last paragraph, first sentence. The aforementioned cover the limitations of claim 14. 

23. As per claim 15, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches the useable areas of a disk space 
are partitioned into separate segments in any given partitioned disk. See Frisch, page 
395, Figure 9-1, disk 1; page 410, Figure 9-3. It would be obvious to one of ordinary 
skill in the art at the time the invention was made for the useable areas of the disk 
space to be partitioned into separate segments to enable each disk partition to be 
usable to a user or application. The aforementioned cover the limitations of claim 15. 
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24. As per claim 16, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Wells and Kim teach the antivirus unit scans 
useable areas of the disk space. See Kim, page 1 1 , Figure 2; see Wells, col. 1 , lines 
54-60. It would be obvious to one of ordinary skill in the art at the time the invention 
was made for the antivirus unit to scan useable areas of the disk space since these 
areas are workspaces having read/write privileges for users and applications and are 
prone to integrity attacks when a virus attains these privileges. The aforementioned 
cover the limitations of claim 16. 

25. As per claim 18, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein a particular segment assigned to a first host is inaccessible to other hosts. See 
Frisch, page 29, Table 2-3, 'no access'; page 30, 5^ line 'Other Access' and Figure 2-1 ; 
pages 228-229 'Using Groups Effectively', especially page 228, 4^ paragraph, second 
sentence. It would be obvious to one of ordinary skill in the art at the time the invention 
was made for a particular segment assigned to a first host to be inaccessible to other 
hosts for the purpose of enforcing non-use of those who do not require access to a 
segment. See Frisch, page 228, 4^^ paragraph, second sentence. The aforementioned 
cover the limitations of claim 18. 

26. As per claim 1 9, Wells covers a method as outlined above in the claim 1 8 
rejection under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the 
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UNIX OS wherein all of the segments are at least readable by the antivirus unit. See 
Frisch, page 29, Table 2-3, 'read access only'; page 30, 3'"^ line 'Group access' and 
Figure 2-1 ; pages 228-229 'Using Groups Effectively', especially page 228, 3'"^ 
paragraph, first sentence and 4^^ paragraph, last sentisnce. It would be obvious to one 
of ordinary skill in the art at the time the invention was made for all of the segments to 
be readable by the antivirus unit to enable the antivirus unit to comprehensively check 
the Integrity of the disk. See Frisch, page 228, 3^^ paragraph, first sentence and 4^^ 
paragraph. The aforementioned cover the limitations of claim 19. 

27. As per claim 20, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Kim and Frisch teach that at least a portion of the 
antivirus unit is provided on at least some controllers for disks corresponding to the disk 
space. See Kim, page 1 1 , Figure 2, first entry Veto' and Section 4.2; see Frisch, pages 
398-405, The Fllesystem Configuration File', especially page 398, '/etc/fstab'. It would 
be obvious to one of ordinary skill in the art at the time the invention was made for a 
portion of the antivirus unit to be provided on at least some controllers for disks 
corresponding to the disk space to enable a comprehensive integrity check 
methodology. The aforementioned cover the limitations of claim 20. 

28. As per claim 21 , Wells covers a method as outlined above in the claim 20 
rejection under 35 U.S.C. 103(a). In addition, Kim teaches Tripwire is provided with file 
structure information for files stored in the disk space. See Kim, page 1 1 , section 4.2, 
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tw.config selection-mask +in. It would be obvious to one of ordinary skill in the art at the 
time the invention was made for the antivirus unit to be provided with file structure 
information for files stored in the disk space to enable the unit to check for integrity 
inconsistencies in the file structure as taught by Kim. Ibid. The aforementioned cover 
the limitations of claim 21 . 

29. As per claims 22-25, Wells covers a method as outlined above in the claim 1-16 
and 18-21 rejections under 35 U.S.C. 103(a). In addition, Kim teaches a first scan at a 
first time and a second scan at a second time after the first time, wherein the results of 
the first scan are taken into consideration in the performing of the second scan as 
outlined in the invention covered in the claim 1-16 and 18-21 rejections. See Kim, page 
1 4, section 4.5, It would be obvious to one of ordinary skill in the art at the time the 
invention was made for there to be a first virus scan at a first time and a second virus 
scan at a second time after the first time and dependent on the results of the first scan 
since the scans are automated on a periodic basis and the integrity of the segments 
must be accounted for consistent with preceding scans starting with the inception of the 
checks to ensure integrity is maintained over the course of multiple periods. See Kim, 
page 14, section 4.5, 1^* paragraph of the section, 3'^ sentence. The aforementioned 
cover the limitations of claims 22-25. 

30. As per claims 26-35, they are apparatus claims corresponding to claims 1-12 and 
they do not teach or define above the information claimed in claims 1-12. Therefore, 
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claims 26-35 are rejected as being unpatentable over Wells in view of Frisch and Kim 
for the same reasons set forth in the rejections of claims 1-12. 

31 . As per claims 36-38, they are apparatus claims corresponding to claims 22-25 
and they do not teach or define above the information claimed in claims 22-25. 
Therefore, claims 36-38 are rejected as being unpatentable over Wells in view of Frisch 
and Kim for the same reasons set forth in the rejections of claims 22-25. 

32. As per claims 39, 42 and 44-46, they are apparatus claims corresponding to 
claims 1, 13, 14 and 20, and they do not teach or define above the information claimed 
in claims 1 , 13, 14 and 20. Therefore, claims 39, 42 and 44-46 are rejected as being 
unpatentable over Wells in view of Frisch and Kim for the same reasons set forth in the 
rejections of claims 1, 13, 14 and 20. 

33. As per claim 40, Wells covers an antivirus unit as outlined above in the claim 39 
rejection under 35 U.S.C. 103(a). In addition, Kim teaches an embodiment of Tripwire 
wherein the means for coupling includes means for coupling to only one storage device. 
See Kim, pages 1 4-1 5, section 5. It would be obvious to one of ordinary skill in the art 
at the time the invention was made for the means for coupling to include means for 
coupling to only one storage device to provide a personal integrity checking means. 
See Kim, page 14, section 5, paragraph in the section. The aforementioned cover 
the limitations of claim 40. 
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34. As per claim 41 , Wells covers an antivirus unit as outlined above in the claim 39 
rejection under 35 U.S.C. 103(a). In addition, Kim teaches an embodiment of Tripwire 
wherein the means for coupling includes means for coupling to more than one storage 
device. See Kim, page 10, section 4.1 .2, 'Scalability'. It would be obvious to one of 
ordinary skill in the art at the time the invention was made for the means for coupling to 
include means for coupling to more than one storage device to share one configuration 
of the integrity checker across a multitude of storage devices for a consistent integrity 
check methodology across the storage network. See Kim, page 10, section 4.1 .2, 1®^ 
and 2"*^ paragraph in the section. The aforementioned cover the limitations of claim 41 . 

35. As per claims 47-50, they are apparatus claims corresponding to claims 1 3, 20, 
22 and 23, and they do not teach or define above the information claimed in claims 13, 
20, 22 and 23. Therefore, claims 47-50 are rejected as being unpatentable over Wells 
in view of Frisch and Kim for the same reasons set forth in the rejections of claims 13, 
20, 22 and 23. 

36. Claim 17 is rejected under 35 U.S.C. 103(a) as being unpatentable over Wells in 
view of Frisch and Kim, and further in view of Stang "Comparison: Products to Detect 
Changes to Programs" (hereinafter Stang). 
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37. As per claim 17, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). Wells does not specify the antivims unit scanning a portion of 
the disk space independently of any file structures corresponding to the disk space. 
Stang discloses several integrity checkers that scans disk space independently of any 
file structures corresponding to the disk space. See Stang, page 14, 'Checkup' and 
The Detective'. It would be obvious to one of ordinary skill in the art at the time the 
invention was made for the antivirus unit to scan independent of any file structures. 
Motivation to combine simplifies the scanning procedure by scanning everything on the 
disk as taught by Stang. Ibid. The aforementioned cover the limitations of claim 17. 

38. Claim 43 is rejected under 35 U.S.C. 103(a) as being unpatentable over Wells in 
view of Frisch and Kim, and further in view of Tso et al. U.S. Patent No. 6,088,803 
(hereinafter Tso). 

39. As per claim 43, Wells covers a method as outlined above in the claim 42 
rejection under 35 U.S.C. 103(a). Wells does not specify an embodiment wherein the 
antivirus unit is interposed between the at least one storage device and the at least one 
host. Tso discloses an antivirus accelerator for computer networks wherein an antivirus 
unit is interposed between a storage device and a host, wherein files requested by the 
host is first scanned by the anfivirus unit then submitted to the host if no'virus is 
detected. See Tso, figure 1 and related text. It would be obvious to one of ordinary skill 
in the art at the fime the invenfion was made to apply the apparatus of Tso to the 
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apparatus of Wells. Motivation for such a combination safeguards information being 
transferred from a storage unit to a host. See Tso, col. 1, lines 48-55. The 
aforementioned cover the limitations of claim 43. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Nachenberg U.S. Patent No. 6,021,510. 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly. THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 



Application/Control Number: 09/715,643 



Page 18 



Art Unit: 2132 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jung W Kim whose telephone number is (571 ) 272- 
3804. The examiner can normally be reached on M-F 9:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gllberto Barron can be reached on (571) 272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-91 97 (toll-free). ( ) 
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